101 lines
3.7 KiB
Nix
101 lines
3.7 KiB
Nix
{ lib, ... }:
|
|
|
|
{
|
|
age.secrets.agentXmpp = {
|
|
file = ../../../secrets/agentXmpp.age;
|
|
owner = "drone";
|
|
};
|
|
|
|
age.secrets.builderXmpp = {
|
|
file = ../../../secrets/builderXmpp.age;
|
|
owner = "drone";
|
|
};
|
|
|
|
age.secrets.agentCalendarPw = {
|
|
file = ../../../secrets/agentCalendarPw.age;
|
|
owner = "drone";
|
|
};
|
|
|
|
# Shared by board-agent-worker (review/research/split) and
|
|
# agent-codex-builder -- both already run as "drone", so one runtime copy
|
|
# is enough (unlike the orgaCalendarPw/orgaMailPw split above, which
|
|
# exists specifically to keep separate Unix users from sharing a path).
|
|
age.secrets.openrouterApiKey = {
|
|
file = ../../../secrets/openrouterApiKey.age;
|
|
owner = "drone";
|
|
};
|
|
|
|
# Separate runtime copies keep the Orga clients away from credentials.
|
|
# Only the dedicated network services can read these paths.
|
|
age.secrets.orgaCalendarPw = {
|
|
file = ../../../secrets/agentCalendarPw.age;
|
|
owner = "orga-calendar-read";
|
|
};
|
|
|
|
age.secrets.orgaMailPw = {
|
|
file = ../../../secrets/mailPW.age;
|
|
owner = "orga-mail-read";
|
|
};
|
|
|
|
# Same underlying credential as orgaMailPw (same mail@lukasrosier.com
|
|
# account) -- a separate runtime copy for the write-scoped mail-draft
|
|
# service, mirroring the orgaCalendarPw/orgaCalendarWritePw split.
|
|
age.secrets.orgaMailDraftPw = {
|
|
file = ../../../secrets/mailPW.age;
|
|
owner = "orga-mail-draft";
|
|
};
|
|
|
|
# Full-admin Radicale write capability -- same underlying credential as
|
|
# orgaCalendarPw/agentCalendarPw (the "calendar" LDAP identity), a
|
|
# separate runtime copy for the dedicated orga-calendar-write service
|
|
# user. See the rights rule "05-calendar-admin-full-access" in
|
|
# hosts/pinix/localServices/calendar/radicale.nix for why this identity
|
|
# is now admin-capable across all collections, not just calendar/public.
|
|
age.secrets.orgaCalendarWritePw = {
|
|
file = ../../../secrets/agentCalendarPw.age;
|
|
owner = "orga-calendar-write";
|
|
};
|
|
|
|
# These globally declared secrets belong to services that run only on pinix.
|
|
# Keep the unused blunix copies root-owned so agenix activation does not
|
|
# depend on service users that intentionally do not exist on this host.
|
|
# bindPW is the exception: Prosody now runs on blunix too (see
|
|
# hosts/blunix/localServices/prosody/setup-prosody.nix), which reads it
|
|
# directly as its own LDAP bind config include, so it keeps the
|
|
# `owner = "prosody"` from the global declaration instead of being forced
|
|
# to root here.
|
|
age.secrets.mailPW.owner = lib.mkForce "root";
|
|
age.secrets.oidcGTS.owner = lib.mkForce "root";
|
|
age.secrets.oidcGTSEnv.owner = lib.mkForce "root";
|
|
age.secrets.webdav.owner = lib.mkForce "root";
|
|
age.secrets.lldapAdmin.mode = lib.mkForce "400";
|
|
|
|
age.secrets.pinixHeadscalePreAuthKey = {
|
|
file = ../../../secrets/pinixHeadscalePreAuthKey.age;
|
|
owner = "root";
|
|
mode = "400";
|
|
};
|
|
|
|
# Dex reads these files as root while preparing its runtime configuration.
|
|
age.secrets.oidcVikunja.file = ../../../secrets/oidcVikunja.age;
|
|
age.secrets.oidcAudiobookshelf.file = ../../../secrets/oidcAudiobookshelf.age;
|
|
age.secrets.oidcQuantum.file = ../../../secrets/oidcQuantum.age;
|
|
age.secrets.oidcTrek.file = ../../../secrets/oidcTrek.age;
|
|
|
|
age.secrets.oauth2Cookie.file = ../../../secrets/oauth2Cookie.age;
|
|
|
|
age.secrets.traefikBasicAuth = {
|
|
file = ../../../secrets/traefikBasicAuth.age;
|
|
owner = "traefik";
|
|
};
|
|
|
|
# Prosody's motd, included by hosts/blunix/localServices/prosody/
|
|
# setup-prosody.nix. Global secretFiles.nix doesn't declare this one
|
|
# (only pinix's now-fallback localServices/secrets.nix did), so it
|
|
# needs the same owner/name override here after the move.
|
|
age.secrets.motd = {
|
|
file = ../../../secrets/motd.age;
|
|
name = "motd.cfg.lua";
|
|
owner = "prosody";
|
|
};
|
|
}
|